Hetzner HA WordPress

This repository contains scripts and configuration files to set up a highly available (HA) WordPress instance on Hetzner Cloud infrastructure. The aim of this project is to provide a robust and scalable solution for hosting a WordPress website with high availability.

Table of Contents

• Features
• Requirements
• Deployment
• Testing
• Open Tasks
• License

Features

• Automated deployment of cloud infrastructure via terraform
• Automated provisioning of the servers with ansible
• A Hetzner TCP Loadbalancer forwards to the loadbalancer server
• The loadbalancer server terminates TLS, automatically renews the Let's encrypt certificates and loadbalances requests between application servers using Caddy
• The replication of wordpress files between machines is done with GlusterFS
• The MySQL database is running on the loadbalancer for now, since this is the only server allowed to fail

Requirements

Before you begin, ensure you have the following:

• A Hetzner Cloud account and API token
• A recent installation of ansible
• Installed the latest version of the ansible community collection ansible-galaxy collection install community.general
• A recent installation of terraform

Deployment

The whole deployment is done from one ansible playbook. The playbook deploys the cloud infrastructure with terraform and provisions the different servers. In the end the public IPs are removed with terraform.

Change into the ansible folder

cd ansible

Export the hcloud token as environment variable

export HCLOUD_TOKEN="<your-hcloud-token>"

Write the terraform vault password to a file, to not always having to type the password

echo "<ansible-vault-pass>" > vault_pass

Deploy the infrastructure. This can take several minutes on the first run.

ansible-playbook playbook.yaml --vault-password-file vault_pass

To verify that everything is setup you can use the hcloud CLI.

hcloud server list

You should see three running webservers and one loadbalancer.

Testing

To test the provisioning with ansible, vagrant is used. The secrets are stored in an ansible vault. Vagrant expects them in a password file vault_pass in the root of the repo. This file is not included for obvious reasons. Please ask the project maintainer if you need the vault password.

Launch the virtualboxes inside the repository root folder

vagrant up

For subsequent tests of the playbook run

vagrant provision

To connect to a specific machine run

vagrant ssh web1

Future work

• Use an external secret provider
• Store the terraform state remotely
• Monitoring and alerting

License

Hetzner HA WordPress is licensed under the MIT License.